iPhone BootROM Flaws Enable Physical Attacks on Older Devices for Crypto Theft
New exploits targeting older iPhone BootROM flaws allow physical access attacks to potentially steal cryptocurrency seed phrases, even on offline devices.
New exploits targeting BootROM flaws in older iPhones, including the XS, 11 series, and second-generation SE, present a significant risk to cryptocurrency holders who use these devices as offline cold wallets. The exploit, known as usbliter8, allows attackers with physical access to execute code before the iOS operating system even loads, bypassing standard security measures.
While these attacks do not directly compromise Apple's Secure Enclave—the hardware component responsible for protecting sensitive keys and passcodes—they can enable the theft of cryptocurrency seed phrases. These phrases are the master keys to a user's wallet, and their compromise means complete loss of access to funds. The vulnerability exploits faulty USB controller behavior and a lack of memory restrictions during the device's early startup phase, allowing specially crafted USB traffic to corrupt memory and load unsigned boot software.
Researchers have demonstrated that the necessary hardware for such an attack can be inexpensive, with a Raspberry Pi Pico 2 board being sufficient. This low barrier to entry means that individuals gaining physical possession of an affected iPhone could potentially carry out this attack. The checkm8 exploit, which affects iPhones up to the iPhone X, is a precursor, but usbliter8 extends the threat to Apple's A12 and A13 chips.
It is crucial to understand that this attack vector requires physical access to the device. Simply having an older iPhone offline is not inherently insecure, but treating it as a secure cold storage solution without considering physical security risks is a mistake. The vulnerability lies in the BootROM, the very first code that runs when a device powers on, which is embedded in the chip and cannot be patched via standard iOS updates.
Despite the BootROM vulnerability, encrypted user data and sensitive operations within the Secure Enclave remain protected by additional security layers. However, the potential for attackers to gain a foothold before the main operating system loads creates a pathway for further exploitation or social engineering to extract wallet information.
Security experts advise users to remain vigilant. While BootROM flaws cannot be patched, users should ensure their devices are updated to the latest possible iOS version to mitigate other software-based vulnerabilities. Strong device passcodes and wallet passwords remain essential as additional layers of defense. For those concerned about potential exposure, the safest course of action is to generate a new seed phrase in a trusted environment and transfer all cryptocurrency assets to a new wallet.
This threat underscores the evolving landscape of cryptocurrency security, where even seemingly offline devices can be vulnerable to sophisticated physical attacks. The reliance on older hardware, while cost-effective, introduces risks that must be carefully weighed against the value of the assets being protected.